HackingHealthcareProfessional ServicesHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)PHICredentialsHighContained

Central Valley Regional Center

bd_29ab4518a5c95a5a · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 29, 2019

Filed

Oct 24, 2019

To disclose

12 weeks

Affected

11,990state residents only

Linked

3 filings

Confidence

65%

Full breach record for Central Valley Regional Center →2 incidents on file

Central Valley Regional Center (CVRC) experienced unauthorized access to employee email accounts between July 25 and August 2, 2019. CVRC discovered the incident on July 29, 2019. The breach potentially affected 11,990 California residents, exposing personal information including names, SSNs, driver's license numbers, Medi-Cal numbers, financial account details, and health information. CVRC engaged forensic investigators, notified the FBI, and provided 12 months of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 29, 2019 → Notified Oct 18, 201981d ✗ CA 60-day late12 weeks discovery → filing

Incident timeline

undetected · 4 days

discovery → filing · 12 weeks / 87 days

Jul 25, 2019

Begins

Jul 29, 2019

Discovered

Oct 24, 2019

Filed

vs. sector median

on median

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_da5a182176d08e422019-10-18 · +6dVerified
HHS OCRbd_1b96bb4bf5e1aaad2019-10-11 · +13dVerified

Name: Central Valley Regional Center
norm: central valley regional center

Name: Central Valley Regional Center
norm: central valley regional center
Industry: HealthcarellmProfessional Servicesllm

Discovered: Jul 29, 2019
Breach occurred: Jul 25, 2019 – Aug 2, 2019
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 18, 2019
Affected individuals: 11,990state-resident count only
Data types: Identity (basic)Government IDFinancial accountFinancial credentialsHealth (basic)PHICredentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: Notified the California Attorney GeneralNotified the Federal Bureau of Investigation (FBI)
Initial access: valid_credentials

During the incident: Disabled access to the account
Engaged a digital forensics firm to assess the scope of the incident
Notified the Federal Bureau of Investigation (FBI)
Provided notification to all potentially affected individuals via a notice on CVRC’s website and media notification
Mailed notification letters to individuals’ last known address
Offered all potentially affected individuals complimentary credit monitoring and/or identity monitoring services for 12 months
Changes made: Taken measures to further enhance the security of personal information in its possession
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(87 days from discovery to filing)
Compliance flags: CA 60-day late · 81d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 29, 2019
→ Notified: Oct 18, 2019
81d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 29, 2019 → Notified: Oct 18, 2019	81d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCROct 11 · first

Montana State AG+7d

California State AG+13d · this page

Pattern: first filing Oct 11 (CA), last Oct 24 (CA) — a 13-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-183781
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 24, 2019
Raw hash: f9297db5de250ee9bec07885e2fbcd384f536bb568a9622f6cca3325a1f97258

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCentral Valley Regional Center

Victim entityCentral Valley Regional Center

Incidentdiscovered Jul 29, 2019

Stated responseDisabled access to the account

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov